VulnCheck KEV: CVE-2018-8033

In Apache OFBiz 16.11.01 to 16.11.04, the OFBiz HTTP engine org.apache.ofbiz.service.engine.HttpEngine.java handles requests for HTTP services via the /webtools/control/httpService endpoint. Both POST and GET requests to the httpService endpoint may contain three parameters: serviceName,...

CVE-2019-0189

The java.io.ObjectInputStream is known to cause Java serialisation issues. This issue here is exposed by the "webtools/control/httpService" URL, and uses Java deserialization to perform code execution. In the HttpEngine, the value of the request parameter "serviceContext" is passed to the...

PT-2019-11182

Name of the Vulnerable Software and Affected Versions: Apache Ofbiz versions prior to 16.11.06 Description: The issue is related to Java serialisation problems caused by the java.io.ObjectInputStream. It is exposed through the "webtools/control/httpService" URL and uses Java deserialization for...

PT-2019-4335

Name of the Vulnerable Software and Affected Versions Apache OFBiz versions prior to 16.11.06 Description The issue exists due to insufficient input validation in the Apache OFBiz HTTP engine, specifically in the org.apache.ofbiz.service.engine.HttpEngine.java component. This allows a remote...

CVE-2018-8033

In Apache OFBiz 16.11.01 to 16.11.04, the OFBiz HTTP engine org.apache.ofbiz.service.engine.HttpEngine.java handles requests for HTTP services via the /webtools/control/httpService endpoint. Both POST and GET requests to the httpService endpoint may contain three parameters: serviceName,...